DigiCert plugin

Use DigiCert through Corsair: one client, typed API calls. The plugin implements all 656 currently documented non-webhook HTTP endpoints across DigiCert families and all 663 route/query modes. CertCentral and Report Library use X-DC-DEVKEY; DigiCert ONE APIs use a separate service-user token in x-api-key; Content Trust operations that document OAuth2 also accept authType: 'oauth_2' with the service scope. Public TLM version and CSC info operations need no key. Webhook operations are out of scope, five deprecated TLM routes are excluded, and 14 CertCentral Discovery catalog operations were discontinued on October 1, 2026. DigiCert ONE also offers mTLS, which this plugin does not implement. See route-inventory.md for per-family counts, exclusions, and sources. What you get:

663 typed API operations

Setup

Install

npm install corsair @corsair-dev/digicert better-sqlite3
npm install --save-dev @types/better-sqlite3

yarn add corsair @corsair-dev/digicert better-sqlite3
yarn add --dev @types/better-sqlite3

pnpm install corsair @corsair-dev/digicert better-sqlite3
pnpm install --save-dev @types/better-sqlite3

bun add corsair @corsair-dev/digicert better-sqlite3
bun add --dev @types/better-sqlite3

Add the plugin

corsair.ts

import Database from 'better-sqlite3';
import { createCorsair } from 'corsair';
import { digicert } from '@corsair-dev/digicert';

export const corsair = createCorsair({
	plugins: [
		digicert(),
	],
	database: new Database('corsair.db'),
	kek: process.env.CORSAIR_KEK!,
	multiTenancy: true,
	hub: {
		projectApiKey: process.env.CORSAIR_API_KEY!,
		signingSecret: process.env.CORSAIR_SIGNING_SECRET!,
	},
});

With multiTenancy: true, scope calls with corsair.withTenant(id). See Quick start for KEK + Hub keys, and Multi-tenancy for account isolation.

Choose authentication

API Key (Recommended)
OAuth 2.0

Store the DigiCert API key before the first call: pnpm corsair setup --plugin=digicert --tenant=acme api_key=<your-key> (leave out --tenant without multiTenancy), or pass it as key in the plugin options. With Hub, each tenant enters their own key on the connect page. See API key auth.

digicert()

More: API Key

Open hub.corsair.dev, navigate to your project, and enter the client ID and client secret from your DigiCert OAuth app.

digicert({
	authType: 'oauth_2',
})

More: OAuth 2.0

Connect a tenant

Mint a connect link and send the tenant to it. Hub hosts the page and delivers the result to your app — see Connect / OAuth.

const { connectUrl } = await corsair.manage.connect.createLink({
	plugin: 'digicert',
	tenantId: 'acme',
});
// redirect the user's browser to connectUrl

Example API calls

List Account Manager locales

const tenant = corsair.withTenant('acme');
await tenant.digicert.api.accountManager.locales({});

Add tags to a certificate

const tenant = corsair.withTenant('acme');
await tenant.digicert.api.trustLifecycle.addCertificateTags({
	certificateId: '00000000-0000-0000-0000-000000000000',
	tags: ['reviewed'],
});

See the full list on the API page.

What’s next

API reference

Every digicert.api.* operation with input and output types.

Connect / OAuth

createLink, Hub delivery, and tenant connect flows.

Use with agents

Expose this plugin’s operations as MCP tools.

Overview

Plugins